Get a pre-built Grafana dashboard. Available dashboards: - agent-os-overview: Main overview for SOC teams - agent-os-safety: Saf

Increment a counter metric. Args: name: Metric name value: Amount to increment labels: M

Ingest a scan result, deduplicating against existing inventory. Returns summary: {"new": N, "updated": N, "total": N}

Check whether *collection* is permitted under this policy. When a Cedar policy is configured, delegates to the Cedar engine. Otherwis

Log a successful execution. Updates the audit entry to ``allowed`` status and records the result and timing information. Arg

Record a liability event.

Record a ring call and return a ``BreachEvent`` if anomalous. Returns ``None`` when the call is within normal parameters.

Record a response latency in milliseconds.

Record a successful task completion.

Register an execution surface with its active capabilities.

Register a worker in the hub.

Build a single assistant text response.

Extract trusted metadata sources from objects exposing skill attrs.

Validate code via AST static analysis for blocked calls. Args: code: Python source code to analyze. Returns:

Run governance verification and validate runtime evidence. Evidence failures always force ``passed=False`` unless the caller explicit

Wrap a Mistral client with governance. Args: client: A ``MistralClient`` or ``Mistral`` client instance. Returns:

Wrap a Gemini GenerativeModel with governance. Args: model: A ``google.generativeai.GenerativeModel`` instance. Returns:

Check *content* against ``blocked_patterns`` in the policy. Matching is case-insensitive substring search. Args: content

Discover an advanced provider via entry_points. Returns the provider class if found, None otherwise.

Make a GET request and return (status_code, json_body).

Create a ``PolicyProviderHandler`` with mock dependencies.

Create a kernel with sensible test defaults.

Rule that denies PII-containing actions.

Create an Alice (sender) / Bob (receiver) ratchet pair via X3DH.

Compute stats from a list of nanosecond timings.

Add credits to an agent's balance.

Assess the reversibility of an action before execution.

ADK before_agent_callback — called before agent starts processing. Returns: None to allow, or a Content-like object to s

Configure OpenTelemetry TracerProvider and MeterProvider for AGT. Reads configuration from environment variables when parameters are not prov

Check if an agent can perform an action given their ring level. Validates both ring-level access and resource constraints.

Validate an action against all configured frameworks.

Generate a new Ed25519 identity for a named agent.

Deploy a new agent version to the inactive environment. Args: version: The agent version string to deploy. Returns:

* Evaluate using legacy flat rules (v0.1 compatible). * First match wins; default is 'deny'.

Intercept import via the modern finder protocol.

Build a :class:`SignedAuditEntry` from an :class:`AuditEntry`. Args: entry: The raw audit entry. previous_hash: Hash

Parse a DID string.

Build a single assistant function-call response.

Get an agent by DID. Args: did: Agent's DID Returns: Agent entry or None if not found

Return the role for an agent, defaulting to READER.

Return the current trust score for *plugin_name*. Returns 500 (``standard`` floor) if the plugin has no recorded score.

Ingest a signal and potentially create an incident. Creates incidents for P1/P2 signals. P3/P4 signals are logged only.

Check if this finding blocks PR merge.

Check if this episode represents a failure/anti-pattern. Returns: True if the episode is marked as a failure

Append an entry to the audit chain.

Trace an outgoing MCP tool call. Args: server_id: ID of the MCP server. tool: Tool name being invoked. pa

Run pre-execution policy checks and return a structured result. Args: ctx: Execution context for the governed operation.

Record an agent action for collective evaluation. This should be called by the governance pipeline after each action.

Record a task outcome and update history.

Register an SLO for dashboard tracking.

Resolve a governance chain into a flat ACS manifest. Args: root: Workspace root that bounds discovery. action_path: Path the agen

Rotate credentials for an active agent.

Route *query* — always returns the default SMART tier. Args: query: The user query to route. Returns:

Scan a prompt using the configured mode (synchronous).

* Transition to `toState`. Throws if the transition is not allowed from * the current state.

Validate a token and return the credential if valid. Args: token: The bearer token string to validate. Returns:

CheckAccess returns true only if the agent's ring includes the given action. Unassigned agents are denied by default.

NewHTTPGovernanceMiddleware creates net/http middleware backed by the governance stack. The middleware rejects requests unless AgentIDResolver return

Check if client has required capability (with wildcard support).

Discover plugin commands from the ``agt.commands`` entry-point group. Plugin discovery failures must not block the host CLI, but they should

Create a RedisTrustStore backed by fakeredis.

Create a mock CrewAI tool.

Create a minimal Trace for testing.

Write a policy YAML file and return its path.